Secure Science Corporation (www.securescience.net) and Michael Ligh of
http://mnin.org put together a paper on an interesting piece of malware.
We include a removal kit, snort signatures, and source code and
decryptor are available by request.